33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b

Analysis

max time kernel
152s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Target

33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
Size

315KB
MD5

5e999271227fb5df56e7305c5234e340
SHA1

fc78d74086b9aa87f0aba96ea0745e752c2cb994
SHA256

33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b
SHA512

053b1098d92c43d9e2fcc3238de8568a3f68eb5ee21de2657e3e9f3b18c5e07cc9292696e52d4af5261dedd92c50998c7337fcd5cfd64a24e6e948bc071521f9
SSDEEP

6144:/pXjAWMwGpdHN3wAYBQdKBn3pilC74iOkS4CRdHmG:RjjG31SBfJ3piE8iBYeG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

description	pid	process	target process
PID 3364 set thread context of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

pid process

3364 33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

pid	process
3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

description	pid	process	target process
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
PID 3364 wrote to memory of 4944	3364	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe	33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe

C:\Users\Admin\AppData\Local\Temp\33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe
"C:\Users\Admin\AppData\Local\Temp\33a1316216d4c98c6cfb8ba98e138fe4153b9f1494fed7f474443a8cd7ca225b.exe"
2⤵
PID:4944

memory/3364-137-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4944-134-0x0000000000000000-mapping.dmp

Download
memory/4944-135-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4944-138-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download